A fintech startup in Ntinda asks for “a quick VAPT” before a partner review. The founder means a scanner PDF by Friday. The security lead means a scoped engagement with proof of impact and a remediation workshop. Those are not the same product. Confusing them wastes money and leaves real holes.
I teach security modules to Applied Computing students at MUBS and Nkumba, and I run vulnerability assessment and penetration testing work for Kampala clients. This article separates Vulnerability Assessment from Penetration Testing, walks a beginner through a five-phase engagement story, and shows how the skill path maps onto student careers here without encouraging illegal testing.
VA versus PT in plain language
Vulnerability Assessment (VA) asks: what known weaknesses exist across the agreed assets? It is broad. Tools and checklists produce a prioritised list, usually with CVE identifiers and severity scores. Humans still verify false positives.
Penetration Testing (PT) asks: can an attacker chain weaknesses into meaningful impact under the rules of engagement? It is deep. The deliverable is evidence, not only a count of findings.
Together they are VAPT. Assessment without testing can leave unproven noise. Testing without assessment can miss whole asset classes. Hiring managers in Kampala banks, telcos, and growing SaaS teams expect you to know which one you are selling or buying.
Phase 1: Scoping and rules of engagement
Before any scan, write scope. In consulting I refuse verbal-only approvals. The document should name:
In-scope IPs, domains, and applications.
Out-of-scope systems (payment switches, third-party SaaS, production databases if excluded).
Testing windows and emergency contacts.
Allowed techniques and banned actions (no denial-of-service against live customers, for example).
Data handling rules for any screenshots or exports.
Unauthorised testing is illegal. Full stop. Students practising at home must use their own labs, deliberately vulnerable VMs, or platforms that grant permission. Classroom demos at MUBS stay inside the lab VLAN for a reason.
Phase 2: Reconnaissance
Map what exists. Passive OSINT first, then active discovery only inside scope. Typical student-accessible tools include Nmap for ports and service fingerprints. Record versions. Do not skip the boring asset list; many “critical” findings later turn out to be forgotten staging hosts.
For web applications, the open methodology I point juniors to is the OWASP Web Security Testing Guide, with the current stable web release documented under WSTG v4.2. It structures tests for information gathering, configuration, identity, session, input validation, and more. Use it as a checklist, not as a licence to improvise on live systems you do not own.
Phase 3: Vulnerability assessment
Run authenticated and unauthenticated scans where the RoE allows. Commercial tools such as Nessus appear in many job adverts; open options and template scanners appear in labs. Your job is not to paste the raw export into Slack. Your job is to:
Remove obvious false positives.
Group findings by asset and business process.
Rank by exploitability and impact in the client’s context.
Note compensating controls you already observed.
A medium CVE on an internet-facing login can outrank a critical CVE on an isolated lab VLAN. Context is the skill.
Phase 4: Controlled exploitation and proof
Only within scope, prove impact. That might mean demonstrating access to a test record, not dumping a production customer table. Capture evidence that a remediation owner can reproduce. Stop when the objective in the RoE is met. Persistence theatre for its own sake is not professionalism.
In student careers, this phase is where ethics show. The graduates I recommend to Kampala teams are the ones who can explain why they stopped, not only how far they got.
Phase 5: Report and remediation workshop
Clients pay for decisions. A useful report has:
An executive summary in business language (fraud risk, downtime, regulatory exposure).
A technical matrix with asset, finding, evidence reference, severity, and concrete fix.
A short retest plan.
Worked mini-example of one finding line (illustrative wording for a lab app, not a live target):
Finding: SQL injection on search parameter
Asset: https://lab-app.local/items?q=
Evidence: WSTG input-validation checks; parameter reflected in DB error
Impact: Read access to demo catalogue table under test account
Remediation: Parameterised queries; input encoding; WAF rule as temporary shield
Retest: After patch window, repeat WSTG test case on same endpointThen sit with the developers. A PDF nobody reads does not harden anything. In SMEs around Kampala, the workshop is often where configuration fixes happen the same afternoon.
Tooling students can learn without breaking the law
Recon: Nmap, browser dev tools, dig/whois for scoped domains.
Web: OWASP ZAP or Burp Community in a home lab; follow WSTG categories.
Network hygiene: Wireshark on traffic you are allowed to capture.
Reporting: Markdown or LibreOffice templates with screenshots and severity tables.
Leave credential dumping on production Active Directory out of your weekend experiments. Build skills on intentionally vulnerable images and written permission.
Career path from MUBS or Nkumba into Kampala roles
Typical progression I coach:
Strong networking and Linux basics (Packet Tracer plus a home Ubuntu VM).
Python for parsing and small automations; see why Python still works as a first language.
Security+ or equivalent vocabulary; compare options in certifications compared.
Documented lab write-ups. Employers ask what you tested and how you reported it.
Junior SOC or IT security support roles, then VA under supervision, then PT tasks as trust grows.
Consulting rates look attractive on Twitter. Delivery quality and ethics keep clients. Start with clean scope discipline in class projects.
Same-day takeaway
Do this today without touching anyone else’s systems:
Read the WSTG project overview and skim one v4.2 testing category that matches your interest.
Write a one-page fake RoE for a fictional campus club website you invented, including out-of-scope items.
On a local intentionally vulnerable VM you installed yourself, run a single authorized checklist section and draft a five-line finding.
Swap reports with a classmate and mark whether the fix is actionable.
VAPT matters for your career because organisations in Kampala are being asked for assurance by partners, banks, and regulators. Learn to separate scanning from proving impact, and treat written permission as part of the craft, not paperwork to skip.